Policy Definition At Management Group
The policy definition. Uses Azure REST API version 2025-01-01. In version 2.x of the Azure Native provider, it used API version 2021-06-01. Other available API versions: 2020-09-01, 2021-06-01, 2023-04-01, 2024-05-01, 2025-03-01. These can be accessed by generating a local SDK package using the CLI command pulumi package add azure-native authorization [ApiVersion]
. See the ../../../version-guide/#accessing-any-api-version-via-local-packages for details.
Example Usage
Create or update a policy definition at management group level
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
var policyDefinitionAtManagementGroup = new AzureNative.Authorization.PolicyDefinitionAtManagementGroup("policyDefinitionAtManagementGroup", new()
{
Description = "Force resource names to begin with given 'prefix' and/or end with given 'suffix'",
DisplayName = "Enforce resource naming convention",
ManagementGroupId = "MyManagementGroup",
Metadata = new Dictionary<string, object?>
{
["category"] = "Naming",
},
Mode = "All",
Parameters =
{
{ "prefix", new AzureNative.Authorization.Inputs.ParameterDefinitionsValueArgs
{
Metadata = new AzureNative.Authorization.Inputs.ParameterDefinitionsValueMetadataArgs
{
Description = "Resource name prefix",
DisplayName = "Prefix",
},
Type = AzureNative.Authorization.ParameterType.String,
} },
{ "suffix", new AzureNative.Authorization.Inputs.ParameterDefinitionsValueArgs
{
Metadata = new AzureNative.Authorization.Inputs.ParameterDefinitionsValueMetadataArgs
{
Description = "Resource name suffix",
DisplayName = "Suffix",
},
Type = AzureNative.Authorization.ParameterType.String,
} },
},
PolicyDefinitionName = "ResourceNaming",
PolicyRule = new Dictionary<string, object?>
{
["if"] = new Dictionary<string, object?>
{
["not"] = new Dictionary<string, object?>
{
["field"] = "name",
["like"] = "[concat(parameters('prefix'), '*', parameters('suffix'))]",
},
},
["then"] = new Dictionary<string, object?>
{
["effect"] = "deny",
},
},
});
});
package main
import (
authorization "github.com/pulumi/pulumi-azure-native-sdk/authorization/v2"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := authorization.NewPolicyDefinitionAtManagementGroup(ctx, "policyDefinitionAtManagementGroup", &authorization.PolicyDefinitionAtManagementGroupArgs{
Description: pulumi.String("Force resource names to begin with given 'prefix' and/or end with given 'suffix'"),
DisplayName: pulumi.String("Enforce resource naming convention"),
ManagementGroupId: pulumi.String("MyManagementGroup"),
Metadata: pulumi.Any(map[string]interface{}{
"category": "Naming",
}),
Mode: pulumi.String("All"),
Parameters: authorization.ParameterDefinitionsValueMap{
"prefix": &authorization.ParameterDefinitionsValueArgs{
Metadata: &authorization.ParameterDefinitionsValueMetadataArgs{
Description: pulumi.String("Resource name prefix"),
DisplayName: pulumi.String("Prefix"),
},
Type: pulumi.String(authorization.ParameterTypeString),
},
"suffix": &authorization.ParameterDefinitionsValueArgs{
Metadata: &authorization.ParameterDefinitionsValueMetadataArgs{
Description: pulumi.String("Resource name suffix"),
DisplayName: pulumi.String("Suffix"),
},
Type: pulumi.String(authorization.ParameterTypeString),
},
},
PolicyDefinitionName: pulumi.String("ResourceNaming"),
PolicyRule: pulumi.Any(map[string]interface{}{
"if": map[string]interface{}{
"not": map[string]interface{}{
"field": "name",
"like": "[concat(parameters('prefix'), '*', parameters('suffix'))]",
},
},
"then": map[string]interface{}{
"effect": "deny",
},
}),
})
if err != nil {
return err
}
return nil
})
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.authorization.PolicyDefinitionAtManagementGroup;
import com.pulumi.azurenative.authorization.PolicyDefinitionAtManagementGroupArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var policyDefinitionAtManagementGroup = new PolicyDefinitionAtManagementGroup("policyDefinitionAtManagementGroup", PolicyDefinitionAtManagementGroupArgs.builder()
.description("Force resource names to begin with given 'prefix' and/or end with given 'suffix'")
.displayName("Enforce resource naming convention")
.managementGroupId("MyManagementGroup")
.metadata(Map.of("category", "Naming"))
.mode("All")
.parameters(Map.ofEntries(
Map.entry("prefix", Map.ofEntries(
Map.entry("metadata", Map.ofEntries(
Map.entry("description", "Resource name prefix"),
Map.entry("displayName", "Prefix")
)),
Map.entry("type", "String")
)),
Map.entry("suffix", Map.ofEntries(
Map.entry("metadata", Map.ofEntries(
Map.entry("description", "Resource name suffix"),
Map.entry("displayName", "Suffix")
)),
Map.entry("type", "String")
))
))
.policyDefinitionName("ResourceNaming")
.policyRule(Map.ofEntries(
Map.entry("if", Map.of("not", Map.ofEntries(
Map.entry("field", "name"),
Map.entry("like", "[concat(parameters('prefix'), '*', parameters('suffix'))]")
))),
Map.entry("then", Map.of("effect", "deny"))
))
.build());
}
}
Import
An existing resource can be imported using its type token, name, and identifier, e.g.
$ pulumi import azure-native:authorization:PolicyDefinitionAtManagementGroup ResourceNaming /providers/Microsoft.Management/managementGroups/{managementGroupId}/providers/Microsoft.Authorization/policyDefinitions/{policyDefinitionName}
Properties
The Azure API version of the resource.
The policy definition description.
The display name of the policy definition.
The parameter definitions for parameters used in the policy rule. The keys are the parameter names.
The policy rule.
The type of policy definition. Possible values are NotSpecified, BuiltIn, Custom, and Static.
The system metadata relating to this resource.